Cause of gpt-4o-mini’s limited benefit from token batching mitigation

Determine why the OpenAI gpt-4o-mini deployment exhibits substantially smaller reductions in Whisper Leak attack effectiveness under token batching (e.g., batch sizes of five or more tokens) compared to most other provider models, despite token batching otherwise mitigating the attack for the majority of tested systems.

Background

Token batching aggregates multiple tokens per network event to obscure fine-grained size and timing signals. Across many models, batching notably reduces attack effectiveness, but gpt-4o-mini shows a markedly smaller improvement.

The authors explicitly state that the reason for gpt-4o-mini’s relative resistance to batching-based mitigation is unknown, identifying a concrete unresolved question relevant to understanding and improving defenses.